General
- Target 2026-08-10_c9243a1ddc70e360ac4fc45410912e88_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- Sample260811-a925cadj5s
- SHA256 7e7813afd92b8b47aa29ed12000e529b5c9e1c9fd0771ae0dd4f254d166e7f79
- MD5 c9243a1ddc70e360ac4fc45410912e88
- SHA1 e9980c6aa43b749eda44c09b39ba12d0baf92c65
- SHA512 ac07b0329a3662ccbf4cd0d1d530f5cad3456a0fd5219fcc8267ab7c50939b4ab0624eacd428f506a83688fd78a1fe246fc45da2ae58073ffcc771cbba2745c6
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUO:5sPJYtJqwXmFt2
- TLSH T18EF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_c9243a1ddc70e360ac4fc45410912e88_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_c9243a1ddc70e360ac4fc45410912e88_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-10_c9243a1ddc70e360ac4fc45410912e88_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- SHA256 7e7813afd92b8b47aa29ed12000e529b5c9e1c9fd0771ae0dd4f254d166e7f79
- MD5 c9243a1ddc70e360ac4fc45410912e88
- SHA1 e9980c6aa43b749eda44c09b39ba12d0baf92c65
- SHA512 ac07b0329a3662ccbf4cd0d1d530f5cad3456a0fd5219fcc8267ab7c50939b4ab0624eacd428f506a83688fd78a1fe246fc45da2ae58073ffcc771cbba2745c6
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUO:5sPJYtJqwXmFt2
- TLSH T18EF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Adds Run key to start application